For \(k > 1\) , an optimal \(b\) -point attack is no longer equivalent to MCP. Indeed, a point \((\mathbf {x}^{\prime }, y^{\prime }) \in \mathcal {T}\)  may need to be “covered” with multiplicity greater than 1 in order to have its prediction flipped, and it may be covered by multiple different sets in \(\mathcal {S}\) . Thus, the \(k > 1\)  case appears to be strictly more general than the MCP and the related “budgeted MCP” studied in [1]}.
